GHSA-8m7c-hf24-5g47

Source

https://github.com/advisories/GHSA-8m7c-hf24-5g47

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-8m7c-hf24-5g47/GHSA-8m7c-hf24-5g47.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8m7c-hf24-5g47

Aliases

CVE-2026-47386

Published

2026-06-05T16:20:32Z

Modified

2026-06-05T16:30:09.509277580Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

NocoDB: OAuth Authorization Code Race Condition

Details

Summary

Two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_token, refresh_token) pair, breaking the single-use guarantee that PKCE relies on.

Details

The token-exchange flow read is_used and called markAsUsed as an unconditional update at the end of the path. A new OAuthAuthorizationCode.claimByCode method now performs an atomic compare-and-swap (WHERE code = ? AND is_used = false) and is called immediately before OAuthToken.insert, after redirect-URI, PKCE, and client authentication have all succeeded. Only the first concurrent caller's UPDATE wins; the rest see invalid_grant: Authorization code has already been used.

Impact

An attacker who has observed an authorization code and the corresponding PKCE verifier (for example through a malicious OAuth-aware client or by racing a real exchange) could obtain a long-lived refresh token in addition to the legitimate one.

Credit

This issue was reported by @eddieran.

Database specific

{
    "nvd_published_at": null,
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-05T16:20:32Z",
    "cwe_ids": [
        "CWE-362"
    ]
}

References

Affected packages

npm / nocodb

Package

Name: nocodb; View open source insights on deps.dev
Purl: pkg:npm/nocodb

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2026.05.1

Database specific

last_known_affected_version_range

"<= 2026.05.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-8m7c-hf24-5g47/GHSA-8m7c-hf24-5g47.json"